Two PHP flaws, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), allowed access to online systems without a password.
With PHP used by about 70% of websites, the flaws had broad potential reach.
The PHP Foundation released fixes on October 21, 2026; some companies temporarily took servers offline to apply them.
PHP is used on approximately 70% of websites worldwide, including well-known platforms such as WordPress, Drupal, Joomla, and MediaWiki.
How the problems were revealed
The issues were discovered by researchers at Calif.com as part of the Hack the Planet initiative and were dubbed PHP2Shell. The team that maintains the software released official fixes on Wednesday, October 21, 2026.
However, Amazon had identified attempts to exploit the vulnerabilities about a week before the public announcement of the fixes. Later, security companies such as Palo Alto Networks and Trail of Bits confirmed that there had been actual breaches and malicious activity.
READ ALSO
Iran reportedly planning attacks on undersea internet cables
Who was affected and what did they do?
Due to the severity of the situation, companies from various industries, including banks and stores, temporarily took down their servers to implement the necessary updates.
The PHP Foundation attributed part of the early leak to a company pushing patches earlier than the agreed-upon timeframe.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)